The AWS Management Console now loads inside a network with no path to the public internet. Console Private Access became generally available on August 28 for virtual private clouds, the isolated networks customers run inside AWS, that have no internet connectivity at all. Authentication flows, the JavaScript, CSS, and images that draw the page, console-only APIs, and service API calls for supported consoles all travel over PrivateLink endpoints. No internet gateway, no NAT gateway, no proxy allowlist to maintain.
Console Private Access (Source: AWS)
That closes a gap operators in regulated environments have worked around since 2023. Console, sign-in, and service API traffic could already be routed through private endpoints, but the static assets and console-only APIs still came from outside, which left one choice: open a hole in the network for the console, or do everything from the command line.
What you have to stand up
Three interface endpoints per Region do the work: one for the console, one for sign-in, one for console-only APIs. The third is required only when the VPC has no internet path. Private DNS has to resolve the console domains to those endpoints, and the endpoint security groups have to allow HTTPS from your workload subnets, or the connection fails silently. Two checks confirm it worked: a lock icon in the console navigation bar, and CloudTrail ConsoleLogin events with the vpcEndpointId field populated.
Stopping people from signing into their own accounts
Endpoint policies using aws:PrincipalOrgID and aws:ResourceOrgID restrict which identities can reach the console from your network and which resources those sessions can touch. Sign-in resource control policies add a second layer, denying authentication that arrives from an unexpected network.
Valid credentials presented from the wrong place get turned away at the sign-in step, before the console loads. That is what blocks someone from using the corporate network to sign into a personal AWS account and move data out through the browser.
The parts that still need the internet
IAM Identity Center sign-in has no VPC endpoint yet, so initial single sign-on still crosses the public internet. Only a subset of service consoles is supported, and each service needs its own endpoint on top of the three: open the KMS console without a KMS endpoint and the key list hangs. One console page often calls several service APIs, so a missing endpoint tends to show up as an empty panel. Consoles for services that do not support PrivateLink will not load at all in a no-internet VPC. Every endpoint bills at standard PrivateLink rates, per Region.
A misconfigured sign-in policy locks the whole organization out of the console. Configure an excluded break-glass role before enabling enforcement, and remember that CLI and SDK requests signed with SigV4 are untouched by these policies, which makes them the way back in.
Download: The ultimate guide to network operations management
